Submission Details
Severity:
Stakes are not consolidated at deadline.
Vulnerability details
function consolidatePendingStakes() private {
uint256 deadline = block.timestamp - 1 days;
for (int256 i = 0; uint256(i) < pendingStakes.length; i++) {
PendingStake memory _stake = pendingStakes[uint256(i)];
if (_stake.createdAt < deadline) {
positions[_stake.holder].holder = _stake.holder;
positions[_stake.holder].TST += _stake.TST;
positions[_stake.holder].EUROs += _stake.EUROs;
deletePendingStake(uint256(i));
// pause iterating on loop because there has been a deletion. "next" item has same index
i--;
}
}
}
if (_stake.createdAt < deadline)
Stakes will not be consolidated at deadline even though they have been locked for 24 hours. In some scenarios, like when the stakes are consolidated before distributing assets (distributeAssets), user will not be eligible to the rewards even though they should already be.
Impact
User stake will not be consolidated at deadline. In some scenarios user will not receive funds that he is eligible to.
Recommendations
Change if (_stake.createdAt < deadline) to if (_stake.createdAt =< deadline).
Updates
Lead Judging Commences
hrishibhat almost 2 years ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
informational/invalid
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933
USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.